“Finding the Right Solution for OSINT and Investigations”

Join deep dive: Tue, Nov 12, 18:00 CET
08 Jul 2024

Exploring ATT&CK and MISP Data with Maltego

Maltego Team

For the cyber intelligence community, MITRE ATT&CK has become the standard for modeling and communicating adversarial tactics and techniques based on real-world observations. Provided and maintained by the MITRE organization, the ATT&CK Matrices are enabling numerous communities to develop more effective cybersecurity practices.


Introduction đź”—︎

Many organizations run MISP instances with other cybersecurity tools and OSINT for data-driven investigations. Investigators can integrate internal and external data to map with MISP data in various ways. This blog details how to look up information directly in the MISP community using MISP Transforms on Maltego Graph, highlighting its seamless integration for efficient and comprehensive investigations.

How Maltego Integrates with MISP Data đź”—︎

Requirements đź”—︎

API access to MISP instance(s) and MISP-Maltego Library. Pre-requisites and installation instructions are available on GitHub here. Alternatively, if your MISP instance is internet-facing, you can use the integration provided by Maltego. Simply install the “ATT&CK – MISP” Hub item and enter your login information under Settings.

Hub item

Use Cases đź”—︎

With MISP and MITRE ATT&CK Entities and Transforms on Maltego Graph, investigators can query data directly within the same interface during investigations, achieving faster clarity while improving workflow efficiency. They can explore MISP threat-sharing instances, events, attributes, objects, tags, and galaxies for a solid starting point for further exploration. Typical use cases include:

  • Query MISP Datasets: Seamlessly query MISP datasets within Maltego Graph to enhance your investigations with valuable threat intelligence. For instance, query a MISP instance for events containing a specific Indicator of Compromise (IoC).
  • Visualize Connections: Visualize and map relationships between MISP data and other OSINT sources to uncover hidden patterns or connections that might have gone unnoticed. For example, pivot a MISP event into its attributes, objects, tags, galaxies, and related events.
  • Enrich Entities: Enrich Entities discovered during investigations with relevant MISP data, providing additional context and insights into data. For example, explore details from galaxies and related events.
  • Streamline Workflows: Enhance investigative workflows by integrating MISP data for better situational awareness and time savings. For example, categorize related information within the MITRE ATT&CK framework.
  • Foster Collaborative Threat Analysis: Collect, manage, and disseminate intelligence across organizations and with cybersecurity professionals based on the results. This facilitates a streamlined process and collaborative approach that spans the entire threat intelligence lifecycle—from collection and processing to analysis.

Maltego Graph also enables the visualization of the full MITRE ATT&CK framework, MISP Galaxies, and more. These capabilities not only reduce efforts but also ensure a more structured and efficient intelligence collection and analysis process, leading to quicker and more accurate threat detection and response.

Introducing Workflows đź”—︎

  1. Identify Suspicious Information: During your investigations, you may come across suspicious data such as domains, DNS names, email addresses, or IP addresses.
  2. Use MISP Transforms: Utilize MISP Transforms in Maltego Graph to analyze the above information.
  3. Look Up in MISP Community: From any type of Entity, query the MISP community.
  4. Check for Existing Records: Determine if the information has already been recorded in the MISP database to have additional context and insights into the data.

Demonstration đź”—︎

Below, you will find a simple investigation to learn how to leverage Maltego integration with MISP.

  1. Step 1 – Starting with suspicious data

    • Overview: Let us start with an email address that a spam trap has detected. The given email source is hardik.desai.neostructo@mail[.]com. We will continue our investigation of this email address by adding it to a new graph. In the Transform menu, under the ATT&CK and MISP Transform group, use the To MISP Events Transform to find any related events.

    • Maltego task: Select the Phrase Entity containing the email address and run the following Transform:

      • To MISP Events

  2. Step 2 – Checking details for insights

    • Overview: Sure enough, the email has already been recorded as an attribute of event ID 1241. The event info detailed in the Property View also indicates that it is associated with a COVID-related fraud email campaign. Additionally, there are six other attributes and objects linked to this event.

    • Maltego task: Check event details in Property View.

  3. Step 3 – Checking other attributes of the event

    • Overview: Next, we would like to see what else is known about this event (6 attributes).

    • Maltego task: Run the following Transform:

      • To Attributes/Objects

  4. Step 4 – Analyzing and classifying phishing threats

    • Overview: The previous step brought back the list of attributes and objects, including IP addresses, URLs, and domains, and a link to a VirusTotal report. From the Event Entity, there are various steps you could take to get more insights, such as finding related events or pulling a list of the tags.

    • Maltego task: Run the Transform and switch it to List View to check phishing classification.

      • To Tags

  5. Step 5 – Mapping the patterns with MITRE ATT&CK

    • Overview: From the list, we can see that this event is classified as a cyber threat, specifically part of a spear-phishing campaign. It utilizes email spoofing, as shown in the List View image. The event is associated with some ATT&CK patterns. In this case, let’s explore the patterns using the MITRE ATT&CK framework data. By identifying these patterns, we can better protect ourselves against such attacks and test our incident readiness. First, check the details about the malware, software, and tools used in the attack technique. This information will help us understand the threat and improve our defensive strategies.

    • Malteg task: Select “mitre-attack-pattern Spearphishing via Service – T1194” Entity and run the following Transforms to look up the details

      • To Malware/Software/Tools

  6. Step 6 – Exploring attack patterns

    • Overview: After checking the details, we can find other MISP events associated with this attack or search for specific threat actors known to use this attack pattern. This includes identifying which threat actors have utilized the pattern.

    • Maltego task: Run Transform:

      • To Related Galaxies

        As a result, you will find that threat actors like FIN6, Dark Caracal, OilRig, and Magic Hound have used the same pattern. And finally, from a galaxy, there is of course a lot more information you can pivot to.

  7. Step 7 – Exploring mitigation techniques

    • Overview: Now, we can discover suggested mitigation techniques to protect against this type of attack, such as using antivirus or antimalware software, performing user training, and restricting web-based content. For brevity, let’s look at one more example. Using the “To Malware/Software/Tools” Transform on the threat actor called Dark Caracal, we can identify the malware, software, and tools that this threat actor commonly uses.

    • Maltego task: Select threat actor and run the following Transform:

      • To Malware/Software/Tools

Voilà! The result reveals that Dark Caracal prefers to use FinFisher, Bandook, CrossRAT, and Pallas malware for their attacks. This demonstrates the extensive insights provided by integrating MITRE ATT&CK and MISP data using Maltego. The biggest advantage is the ability to extend and enrich investigations or uncover new IoCs through various data integrations without switching tools. To learn more about Maltego’s CTI-specific data integration, check our blog about Maltego Handbook for Cyber Threat Intelligence or simply download the handbook now.



Conclusion đź”—︎

The integration of Maltego with MISP supercharges analysts with unprecedented situational awareness for complex OSINT investigations. By leveraging Maltego’s visualization and data capabilities along with MISP’s extensive threat intelligence data, investigators can uncover hidden connections, enrich their findings, and streamline their workflows—all within the familiar Maltego interface. This powerful combination enhances the depth and efficiency of threat intelligence operations, providing a comprehensive toolset for effective data collection and threat analysis.

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.


Stay connected with us on X and LinkedIn, and subscribe to our email newsletter to get updated with the latest news and developments.

Happy investigating!

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.